Hi Stian,
A few additional comments:
* "or alternatively the application can include an id_token_hint with the
request that proves the application does not need consent from the user"
I understand that ID Tokens should be short-lived, but aren't we setting
the exp of ID tokens with the value from access tokens? See
org.keycloak.protocol.oidc.TokenManager.AccessTokenResponseBuilder#generateIDToken.
In addition to that, I don't think that using a front-channel to pass
tokens is something we want to do given that there are a lot of
considerations around this approach. If we are really going this way, I
think we should at least consider some form of proof-of-possession.
For last, maybe you should explicitly mention the usage of TLS?
Regards.
Pedro Igor
On Wed, Mar 27, 2019 at 9:43 PM Stian Thorgersen <sthorger(a)redhat.com>
wrote:
Based on feedback and also thinking about this a bit more I've
now updated
the proposal for Application Initiated Actions.
Please read and comment on the update draft if you're interested.
https://github.com/keycloak/keycloak-community/blob/master/design/applica...
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev